Cisco ISE Posture Issue – Some Clients Are Assigned to the Wrong Policy Server
Hello Everyone,
I am facing an issue with Cisco ISE Posture and would appreciate your help.
Environment
We have a Cisco ISE deployment with four nodes:
Production ISE1 (0.0.0.1)– Policy Service Node (PSN)
Production ISE2 (0.0.0.2) – Monitoring Node
DR ISE1 (1.1.1.1)– Policy Service Node (PSN)
DR ISE2 (1.1.1.2)** – Monitoring Node
We are using wired authentication and have configured the RADIUS servers on the switch in the following order:
1. Production ISE1
2. DR ISE1
3. Production ISE2
4. DR ISE2
Issue
At one branch, around 10 PCs are connected to the switch.
After applying the ISE configuration to the switch ports:
Most clients authenticate successfully and become Compliant
On these working PCs, Cisco Secure Client shows Production ISE1 as the Policy Server, which is the expected behavior.
However, a few PCs do not become compliant.
When we check ISE Posture Statistics, these affected clients are using DR ISE1 as their Policy Server instead of Production ISE1, even though both working and non-working PCs are connected to the same switch and are using the same switch configuration.
Question
Why are some clients being assigned to DR ISE1 as the Policy Server while others are correctly assigned to Production ISE1?
Has anyone experienced this behavior before? What could cause different clients on the same switch to receive different Policy Servers for posture?
Any guidance or troubleshooting suggestions Would be greatly appreciated.
Thank you.
